Yes, they can, although server scripts bytecodes are never sent to the client regardless of where the script is, therefore they can’t be decompiled, so deleting them does nothing. They can delete localscripts and edit those as well, since the bytecode is replicated, it has to. They can delete everything else as well. But it would only show on their machine.